Platform overview
Issue and renew certificates, control access to secrets, and check what production serves. Built for DevOps, SRE and platform teams running Windows, Linux and mixed infrastructure.
Architecture
Certificates, keys and secrets share the same access controls and audit history. Choose an area below to see how certificate renewal, tokens, host sessions and AI agents connect.
Your team, services and AI agents
Choose an area to read how it works below.
Post-quantum cryptography, shorter certificate lifetimes and Merkle Tree Certificates all raise deployment questions for infrastructure teams. Darren Hudson leads research into what these changes mean for the systems teams have to run. That work feeds directly into CertLocker, so customers meet these changes as a software update rather than a migration project.
Meet Darren and explore the research →Each area below is a gateway or store surface on the same plane - not a separate product silo.
The issuance gateway into artefact custody: multi-CA workflows with live state, DNS-01 automation, ACME profiles (including short-lived and future MTC/PQC shapes), and certificate tokens for HAProxy, win-acme, and every RFC 8555 client.
Certificate lifecycle feature →Scoped tokens so edge systems pull the right PEM, chain, and key - no manual SCP or mystery folders on load balancers.
Certificate delivery feature →Automations can deliver the files and run your service’s installation and activation commands over SSH/SFTP without a CertLocker deployment agent on the target.
Integrations and Automations →Close the loop on the control plane: know what production is actually serving - not just what inventory says. Probes recognise classical chains and PQ-ready MTC / ML-DSA material.
System and private secrets alongside certificates - PEM material, keys, credentials, and configs with the same RBAC and audit model.
Secrets management feature →Just-in-time host access on the same plane as artefacts - token-scoped, time-limited, revocable in seconds. Browser terminal included for break-glass.
Tokens restricted by protocol, IP, 2FA, and group. Agents mediated through MCP. Groups, roles, and a full audit trail across artefact, secret, and access events.